[nsp-sec] MayDay botnet?
Stephen Gill
gillsr at cymru.com
Thu Feb 14 16:57:41 EST 2008
> one of my guys unpacked it and we ran my auto-static analyzer over it, the
> summary report is below. disasm (via IDA) and strings also available.
>
> in short it matches the symantec writeup, but this adds some more lines i
> hope. we didn't detect any of the ICMP communications that dagon claimed
> it did, and we didn't detect any ICMP Win API calls or packet contents in
> a dynamic analkysis, either.
>
We have 10 or 11 samples... The most recent one I looked at has all of the
ICMP callouts to peers as well as:
2008-02-06 15:11:37 192.168.1.1:1047 213.171.218.163:80 6
812 B
2008-02-06 15:11:37 192.168.1.1:1045 213.171.218.163:80 6
1.14 KB
2008-02-06 15:11:37 192.168.1.1:1043 213.171.218.163:80 6
986 B
2008-02-06 15:11:37 192.168.1.1:1048 75.126.177.141:80 6 1.2
KB
2008-02-06 15:11:37 192.168.1.1:1046 75.126.177.141:80 6
1.46 KB
2008-02-06 15:11:37 192.168.1.1:1044 75.126.177.141:80 6
1.28 KB
Which boils down to:
dns: dnsrr: www.maydaynet2008.co.uk
ip: 213.171.218.163
type: A
dns: dnsrr: www.maydaynet2008.co.uk
ip: 213.171.218.163
type: A
http: url:
http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi?password=relax&command=log&f
ilename=mailstat.log&guid={0C98770
7-6FBF-4828-866C-E98AB082448B}|3.9|20080206.15.12.45|00000000.00.00.00|00000
000.00.00.00|0000000000|0000000000
|0000000000|0000000000|0000000000|0000000000|0000000000|0000000000|000000000
0|xxxx-8763a89be1,xxxx-8763a89be1.
com,,
type: GET
useragent: agent00006B8B
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=repo
rt&guid={0C987707-6FBF-4828-866C-E
98AB082448B}-3.9-20080206.15.12.43:10.10.1.1
type: GET
useragent: agent00006B8B
http: url:
http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi?password=relax&command=learn
type: GET
useragent: agent00006B8B
http: url:
http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi?password=relax&command=repor
t&guid={0C987707-6FBF-4828-866C-E9
8AB082448B}-3.9-20080206.15.12.43:10.10.1.1
type: GET
useragent: agent00006B8B
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=lear
n
type: GET
useragent: agent00006B8B
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=log&
filename=mailstat.log&guid={0C9877
07-6FBF-4828-866C-E98AB082448B}|3.9|20080206.15.12.45|00000000.00.00.00|0000
0000.00.00.00|0000000000|000000000
0|0000000000|0000000000|0000000000|0000000000|0000000000|0000000000|00000000
00|xxxx-8763a89be1,xxxx-8763a89be1
.com,,
type: GET
useragent: agent00006B8B
http: url:
http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi?password=relax&command=learn
type: GET
useragent: agent00006457
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=repo
rt&guid={46B9AAEB-E0A1-4C80-9781-5
6F7B8547590}-3.9-20080211.03.41.16:10.10.1.1
type: GET
useragent: agent00006457
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=log&
filename=mailstat.log&guid={46B9AA
EB-E0A1-4C80-9781-56F7B8547590}|3.9|20080211.03.41.21|00000000.00.00.00|0000
0000.00.00.00|0000000000|000000000
0|0000000000|0000000000|0000000000|0000000000|0000000000|0000000000|00000000
00|xxxx-8763a89be1,xxxx-8763a89be1
.com,,
type: GET
useragent: agent00006457
http: url:
http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi?password=relax&command=lear
n
type: GET
useragent: agent00006457
http: url:
http:///cgi-bin/gate.cgi?password=relax&command=report&guid={46B9AAEB-E0A1-4
C80-9781-56F7B8547590}-3.9-2008021
1.03.41.16:10.10.1.1
type: GET
http: url:
http:///cgi-bin/gate.cgi?password=relax&command=log&filename=mailstat.log&gu
id={46B9AAEB-E0A1-4C80-9781-56F7B8
547590}|3.9|20080211.03.41.21|00000000.00.00.00|00000000.00.00.00|0000000000
|0000000000|0000000000|0000000000|
0000000000|0000000000|0000000000|0000000000|0000000000|xxxx-8763a89be1,xxxx-
8763a89be1.com,,
type: GET
First order flow relatives:
213.171.218.163 (11)
75.126.177.141 (13)
12.72.207.186 (1)
70.196.129.177 (1)
68.73.80.239 (2)
First order ip-> dns relatives:
dnsrr count dnsrr first seen
www.maydaynet2008.co.uk 11 2007-07-31 01:08:08
ss1.whbdns.com 2 2007-09-06 10:46:04
Sigbuster:
WinRAR vna SN:940
RAR extractor basically does:
"C:\DOCUME~1\andy\LOCALS~1\Temp\RarSFX0\acrobat32.exe" "
exe_name="C:\DOCUME~1\andy\LOCALS~1\Temp\RarSFX0\acrobat32.exe"
"/S /C {67EA19A0-CCEF-11D0-8024-00C04FD75D13} /I
{00000000-0000-0000-C000-000000000046} /X 0x401"
exe_name="C:\WINDOWS\system32\verclsid.exe"/>
"/S /C {ECF03A33-103D-11D2-854D-006008059367} /I
{00000000-0000-0000-C000-000000000046} /X 0x401"
exe_name="C:\WINDOWS\system32\verclsid.exe"/>
"/S /C {40DD6E20-7C17-11CE-A804-00AA003CA9F6} /I
{00000000-0000-0000-C000-000000000046} /X 0x401"
exe_name="C:\WINDOWS\system32\verclsid.exe"/>
If you need specific info on registry keys let me know.. There are a lot of
reads and writes...
AV:
Ahnlab KR no_virus
Aladdin (esafe) IL Win32.Agent.ax
Alwil (avast) CZ no_virus
Arcabit (arcavir) PL no_virus
Authentium US no_virus
Avira (antivir) DE WORM/Agent.AX.1
BitDefender RO Win32.Worm.Agent.PYN
CA (E-Trust Vet) US no_virus
CAT (quickheal) IN no_virus
Central Command (vexira) US Worm.DayMay.Gen
ClamAV Trojan.Downloader-15130
CPsecure US no_virus
Cybersoft (vfind) US no_virus
Dr. Web RU no_virus
Eset (nod32) US Win32/Agent.NCY worm
Fortinet US W32/Agent.AX at mm
Frisk (f-prot) IS W32/Worm.LEO
F-Secure FI Email-Worm.Win32.Agent.ax
Grisoft (avg) CZ I-Worm/Generic.CCO
Hauri (virobot) KR no_virus
Ikarus AT Trojan.Win32.Agent.JK
Kaspersky RU Email-Worm.Win32.Agent.ax
Mcafee US Spam-DayMay
MicroWorld (escan) IN no_virus
Norman NO no_virus
Panda ES no_virus
Rising CN Worm.Mail.Win32.Agent.ax
Securecomputing (webwasher) US Worm.Agent.AX.1
Sophos GB Troj/Daymay-A
Symantec US Trojan.Daymay
TheHacker PE no_virus
Trend Micro JP no_virus
VirusBlokAda (vba32) BY Email-Worm.Win32.Agent.ax
VirusBuster HU Worm.DayMay.Gen
Cheers,
-- steve
> the sizes, hashes, etc all are bogus for the real version since this is an
> unpacked version.
>
>
> BASIC INFO:
> -----------------------------------------------
> FILE TYPE: application/x-ms-dos-executable
> FILE SIZE: 397312 bytes
> PACKER/S: [FSG v1.10 (Eng) -> dulek/xt]
> -----------------------------------------------
>
> URLS:
> -----------------------------------------------
> http://75.126.177.141/~merc27dc/cgi-bin
> http://75.126.177.141/~merc27dc/cgi-bin/gate.cgi',0
> http://www.maydaynet2008.co.uk/cgi-bin/
> http://www.maydaynet2008.co.uk/cgi-bin/gate.cgi',0
> -----------------------------------------------
>
> FILENAMES:
> -----------------------------------------------
> .dll
> NTDLL.DLL
> USER32.dll
> .exe
> KERNEL32.DLL
> mscoree.dll
> kernel32.dll
> USER32.DLL
> Ws2_32.dll
> Kernel32.dll
> Advapi32.dll
> PSAPI.dll
> Ole32.dll
> Wininet.dll
> Dnsapi.dll
> KERNEL32.dll
> C:\DOCUME~1\asert\LOCALS~1\Temp\svchost.exe
> C:\DOCUME~1\asert\LOCALS~1\Temp\svchost.exe
> user32.dll
> -----------------------------------------------
>
> POSSIBLE REGISTRY KEYS:
> -----------------------------------------------
> SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Stand
> ardProfile\IcmpSettings
> SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\Stand
> ardProfile\AuthorizedApplications\List
> Software\Microsoft\Windows\CurrentVersion\Run
> -----------------------------------------------
>
> POSSIBLE HOSTNAMES:
> -----------------------------------------------
> .com
> Visibleimpact.Com
> usnewscenter.com
> Ukplanet.Com
> The-Factor.Com
> talkcollege.com
> Skywebsite.Com
> Seventies.Net
> selfimprovements.com
> Schoolmatters.Com
> quotedeal.com
> pctopc.com
> parentingdirectory.com
> nicepages.com
> newsbeats.com
> motorcyclesnet.com
> Modernwoman.Com
> Minnesotalotto.Com
> Militaryrecords.Net
> maphq.com
> Mackdaddy.Com
> Lovecalifornia.Com
> kingdomlinks.com
> Kentuckyattractions.Com
> hurricaneweather.com
> hurricanenews.com
> harleylinks.com
> greaternet.com
> gloriousnet.com
> Floridanatives.Com
> Floridamotor.Com
> Floridabiker.Com
> favoritepages.com
> fabulousweb.com
> criminalrecords.net
> BRIDALPLANNER.COM
> Bikemessengers.Com
> bestcoolsites.com
> Angelpictures.Net
> Aerialphotos.Net
> Uniquevisitors.biz
> Selfimprovement.biz
> Policereports.biz
> Newscenter.biz
> Manufacturedhomes.biz
> Localweather.biz
> Lawdegree.biz
> Jacksonvillebeach.biz
> Intelligentdesigns.biz
> Homeauctions.biz
> Holidaydecorating.biz
> Governmentauctions.biz
> Extrememakeovers.biz
> Decoratingideas.biz
> Classreunions.biz
> Bathroomdesign.biz
> Websitedesigns.org
> Vegasvacation.org
> Rolemodels.org
> Plumbingfixtures.org
> Lightingfixtures.org
> Fernandinabeach.org
> Extrememakeovers.org
> Nursingscholarships.net
> Kitchenremodeling.net
> Decorativeideas.net
> Americasmostwanted.net
> Premierbathtubs.com
> Landscapinglighting.com
> Landscape-Lighting.com
> Iqratings.com
> Holidaypromotion.com
> Graduatedegreeprogram.com
> Fatride.com
> Excellentsites.com
> Degreenews.com
> Decorativeideas.com
> Creatememories.com
> Continuelearning.com
> Chocolateturtles.com
> Calendarsearch.com
> Bronxonline.com
> Bathroom-Fixtures.com
> Associates-Degree.com
> Tattoogallery.biz
> Photocontest.net
> Hotornot.net
> Freegreetings.net
> Entertains.net
> Beautifulpictures.net
> Poetrytonight.com
> Jokesoftheday.com
> Hystericalhumor.com
> Humorshop.com
> Hotmag.com
> Greetingsmail.com
> Greetingmail.com
> Greatreviews.com
> Freefunnyjokes.com
> Epopularity.com
> Downloadmoviez.com
> Bikiniscreensavers.com
> Aliasfan.com
> Rentdvds.org
> Karaokeequipment.net
> Realitytv.info
> Celebritynews.info
> Smartjokes.com
> Rentdvdmovies.com
> Redneckfun.com
> Judgemybody.com
> Funnypolls.com
> Discounthdtvs.com
> Celebrityjokes.com
> Tkts.biz
> Missamerica.biz
> Horrorfilms.biz
> Funnyjokes.biz
> Electronicpostcards.net
> Downloadsoftware.net
> Windowsfreeware.com
> Ultimatefreebies.com
> Screensaversnet.com
> Megafreestuff.com
> Justfreeweb.com
> Justfreebies.com
> Gimmefreestuff.com
> Getwallpapers.com
> Getfonts.com
> Freebiztools.com
> Findfreebies.com
> Downloadusa.com
> Desktophorizon.com
> Clipartplanet.com
> Cdshareware.com
> Bestskins.com
> Animationstation.com
> Allfreeart.com
> Absolutelyfreestuff.com
> Freewebsite.info
> Freedvds.info
> Freewebpages.biz
> Freevideogames.biz
> Freelivecams.biz
> Freeinsurancequotes.biz
> Freecards.biz
> Freecreditscores.org
> Freecreditrepair.org
> Freewaresoftware.net
> Freewebsurfing.com
> Freelifequote.com
> Freegamecube.com
> Freecashonline.com
> Free-Canada.com
> wavfilez.com
> songspider.com
> songlyric.net
> Songdirectory.Com
> Sheetmusicpro.Com
> sheetmusicguide.com
> searchlyrics.com
> Rockmusicnews.Com
> rockvideos.net
> pcjam.com
> music-player.com
> musichaggle.com
> musicadvertisers.com
> mp3metasearch.com
> Mp3Megasearch.com
> mp3magnet.com
> mp3hotlist.com
> mp3find.net
> mp3dd.net
> mp3crypt.com
> lyricserver.com
> lyricsearch.net
> Loveguitar.Com
> legalmp3s.net
> guitarsearch.com
> guitarresources.com
> fullmp3s.com
> freemusicmachine.com
> freemusicfinder.com
> freemp3tools.com
> Freecdmusic.Com
> electricguitar.org
> Discvault.Com
> Digitalmp3Player.Com
> audiovalley.com
> audiograb.com
> Musicgifts.info
> Kazza.info
> Freesongs.info
> Electricguitar.info
> Acousticguitar.info
> Voicelessons.biz
> Rockposters.biz
> Remixes.biz
> Musicgifts.biz
> Musicdownloads.biz
> Musicboxes.biz
> Guitarparts.biz
> Guitarchords.biz
> Videoguitarlessons.com
> Musicnews.org
> Freemp3Download.org
> Lead-Guitar.com
> Latinmusicvideos.com
> Countrylyricsearch.com
> Pokemonyellow.net
> Gamehints.net
> Contestants.net
> Computergamer.net
> Cardcentral.net
> Playstationcheats.net
> Gameboycolor.net
> Wirelesswebgames.com
> Sweepstaker.com
> Psxplanet.com
> Prizeoffers.com
> Playstationshop.com
> Playstationplanet.com
> Playstationhints.com
> Playstationcentral.com
> Playgamez.com
> Justprizes.com
> Gamecrawler.com
> Fastgamesnow.com
> Cubez.com
> Coolfreegames.com
> Computergamez.com
> Cheatsandhints.com
> Auctiongames.com
> Internetgaming.Info
> Gamecube.Info
> Bingogames.Info
> Freevideogames.Biz
> Rentgames.Org
> Vitalgames.Com
> Ukonlinegames.Com
> Psxnetwork.Com
> Players-Online.Com
> Newonlinegames.Com
> Gamerewards.Com
> Freegamecube.Com
> Digitalsims.Com
> wirelesscrawler.com
> spidercrawler.com
> Searchfindings.Com
> robocrawler.com
> researchwebsite.com
> photoseek.net
> Payperclicks.Com
> midisearch.net
> lawfinder.net
> Internationalpeoplesearch.Com
> imagesearch.net
> Hugefind.Com
> ftpspider.com
> Findtexas.Com
> Findperson.Net
> Findpeople.biz
> findexpert.com
> ezcrawler.com
> eliteseek.com
> electronicresearch.com
> domaincrawler.com
> cyberdetectives.net
> coolcrawler.com
> cleancrawler.com
> automobilefinder.com
> ancestryfinders.com
> alloftheweb.com
> address-search.com
> Detectives.Biz
> Findaschoolmate.Com
> Accuratepeoplesearch.Com
> turbotravel.com
> tropical-resorts.com
> Skiingconditions.Com
> premiertravel.biz
> Nightcruise.Com
> musicvacation.com
> Mexicocruises.Net
> jamaicainternational.com
> hotjax.com
> flyaway.net
> Destinationtravels.Com
> conceptsintravel.com
> bermudaislands.net
> bermudaislands.com
> auctionfares.com
> Alpinetravels.Com
> Caribbeanresorts.Info
> Traveltickets.Biz
> Timessquare.Biz
> Caribbeanvacation.Biz
> Orlandovacations.Org
> Hotelreviews.Org
> Cheapmotels.Org
> Cheapmotels.Net
> Super-Bowl-Hotels.Com
> Lesbianvacations.Com
> Jaxcruise.Com
> Discountcruisenetwork.Com
> Warehousecellular.Com
> Satellitewholesalers.Com
> Phoneequipment.Net
> Phonecarddistributor.Com
> networkbroadcasting.com
> net2phones.com
> Mobilesearch.Com
> HOTCELLPHONES.COM
> Emailcommunications.Com
> Cellphonediscounts.Com
> Celldeals.Com
> callingcards.biz
> allyourcalls.com
> Teleconferencing.info
> Prepaidcellular.info
> Cellphoneplan.info
> Satellitesystem.biz
> Payphones.biz
> Internationalcalls.biz
> Satellitereceivers.net
> Specialringtones.com
> Satellitedoctor.com
> Local-Telephone.com
> Learnemail.com
> Cheapemail.com
> YourSmallbusiness.com
> Workfromhomebasedbusiness.com
> Workathomemom.biz
> WebpageProfits.com
> WebOpp.com
> WebmasterWealth.com
> Wealthresources.com
> WealthBuilder.biz
> VirtualEarnings.com
> UKprofits.com
> UKmoneymaker.com
> TakeOnlineSurvey.com
> SuperAffiliates.info
> SuperAffiliates.com
> Superaffiliates.biz
> SuperAffiliate.info
> Superaffiliate.biz
> StartupKit.com
> StartmyownBiz.com
> SparetimeProfits.com
> SixfiguresOnline.com
> SixfigureProfits.com
> SixFigure.net
> SFI-Affiliates.com
> SFIaffiliate.com
> Selfpublish.biz
> SecretShopping.net
> SecondIncome.org
> ReferralMadness.com
> PureProfits.net
> ProfitSuccess.com
> ProfitPlay.com
> PreLaunch.org
> PreLaunch.net
> Perpetual-Income.com
> PaidforSurvey.com
> OpportunitiesNet.com
> OnlineProfits.net
> OnlineIncome.biz
> Networkmarketingcompany.com
> NetworkMarketingbiz.com
> NetProfitable.com
> MyfirstBillion.com
> MoneymakingStrategy.com
> MoneyMachines.net
> MoneyinMail.com
> MLMopportunity.com
> MLMmomentum.com
> MLMdownlineclub.com
> MLMcompanies.com
> MLMboard.com
> Mlmarketing.com
> MLMaffiliate.com
> MillionaireMail.com
> MedicalBilling.info
> MarketingOpportunity.com
> MakingMoney.org
> MakeMoneyEasy.com
> LowcostHomebusiness.com
> InternetOps.com
> InternetHomebiz.com
> InternetAffiliate.com
> InnovativeIncome.com
> InfoEntrepreneurs.com
> IncreaseWealth.com
> IncomeVentures.com
> IncomeOps.com
> IdeasforBusiness.com
> HomeworkingHeaven.com
> HomeProfits.com
> HomeofficeBiz.com
> HomebusinessProfits.com
> HomebusinessNews.com
> HomebusinessEbook.com
> HomebizCentral.com
> HomebasedEntrepreneur.com
> HomebasedCash.com
> HomebasedBiz.org
> GoodMoney.net
> GoingPlatinum.com
> FreeMall.com
> FreeHomebiz.com
> FortuneOpportunity.com
> Findyourdream.com
> ExtraMoneymaking.com
> ExplodeIncome.com
> EmailIncome.com
> EcommerceEntrepreneurs.com
> EarnCash.net
> DropshippingUK.com
> Downline-Club.com
> CreativeIncome.com
> CommissionPrograms.com
> CEOentrepreneur.com
> CashAttic.com
> Businessopportunity.info
> Business-Opp.com
> BusinessLeads.biz
> Businessathome.net
> BuildYourDownline.com
> BigCheck.net
> BestMLM.net
> BestHomebusinesses.com
> BestHomebusiness.com
> Bestbusinessopportunities.net
> AuctionEntrepreneur.com
> AuctionBusiness.com
> Athomebusiness.org
> Athomebusiness.biz
> AffiliateVentures.com
> AffiliateVenture.com
> AAAmedicalbilling.com
> WorkFromYourHome.net
> WorkatHomeIdeas.net
> UniversalIncome.com
> ProfitableOpportunities.com
> PartnerPrograms.org
> Online-Ventures.com
> MoneyFromHome.biz
> MLMprospecting.com
> MLMhomebusiness.net
> MakeMoneyVending.com
> HomeTypist.net
> HomebasedNews.com
> FinancialFreedom.biz
> ExplosiveOpportunity.com
> Christian-Home-Business.com
> AffiliateMillionaires.com
> AbundantRiches.com
> MotorcycleTires.biz
> VerticalBlinds.net
> TruckRims.net
> TruckAccesories.net
> SpaFinder.net
> RecreationVehicles.net
> JewelryAuction.net
> GroceryShop.net
> FruitBasket.net
> Finejewelry.net
> EngagementRing.net
> CustomRims.net
> CoffeeBeans.net
> ChromeRims.net
> BuySeafood.net
> BirthdayCards.net
> BabyBedding.net
> WinBid.com
> VirtualValuables.com
> ValentineGoodies.com
> UsedShops.com
> UltimateBid.com
> TotallyPearls.com
> SuperbShopping.com
> Shoppingpedia.com
> ShoppingJewelry.com
> ShoppingGems.com
> ShopFinders.com
> SearchDeals.com
> RugSales.com
> RealMeals.com
> QualityDVDs.com
> PrintaCalendar.com
> PremierGems.com
> PreciousGiftbaskets.com
> PreciousGems.com
> PlushCarpet.com
> Patchez.com
> PalmtopShop.com
> OverniteRoses.com
> OutpostAuctions.com
> NiceJewelry.com
> Netlobster.com
> Mostwantedgear.com
> MinervaWatches.com
> MemorableBaskets.com
> LovePerfumes.com
> JewelryAuctions.com
> ItsMyShop.com
> HollywoodDVDs.com
> HeartVitamins.com
> Gucci-Watches.com
> GourmetStores.com
> GiftbasketBiz.com
> GetGreatCoffee.com
> GearUnlimited.com
> ForeverGems.com
> FineGiftshops.com
> FineGiftshop.com
> FineGiftsDepot.com
> FineDVDs.com
> FashionWebsites.com
> FashionJewelery.com
> EverydayMoments.com
> EmpireDVD.com
> EliteWatches.com
> ElegantFlowers.com
> ElectronicsEquipment.com
> DVDdomain.com
> DutchBid.com
> DiscountSatellite.com
> DiscountFurs.com
> DiamondEngagmentRing.com
> DealDirectory.com
> DealBrowser.com
> Dailywatch.com
> Cornerstores.com
> ComputerFinders.com
> CigaretteKingdom.com
> CDmusicnow.com
> CDboulevard.com
> CamperGear.com
> BargainCables.com
> AwesomeDVDs.com
> AuctionVista.com
> Aromaverde.com
> AntiqueJewelryauction.com
> AffordableRoses.com
> AAAflorist.com
> 4Carats.com
> Skateshop.info
> LeatherBoots.info
> CouponCodes.info
> Birthdaypresents.info
> Antiquewatches.info
> Womensfashion.biz
> Wholesalegifts.biz
> Wholesalecigarettes.biz
> Whitegold.biz
> Weddinginvitations.biz
> Vintagejewelry.biz
> Videorentals.biz
> Uniquejewelry.biz
> Thankyoucards.biz
> Stereos.biz
> Silklingerie.biz
> Scentedcandles.biz
> Romanticgifts.biz
> Replicawatches.biz
> Paintballgear.biz
> Outfitters.biz
> Onlinecoupons.biz
> Megadeals.biz
> Maternityclothing.biz
> Loosediamonds.biz
> Jewerlyboxes.biz
> Jewelrydesign.biz
> Hiphopclothing.biz
> Halloweencostume.biz
> Goldclub.biz
> Goldchains.biz
> Dogleashes.biz
> Discountluggage.biz
> Clubwear.biz
> Carquotes.biz
> Bedsheets.biz
> Babybeds.biz
> Winebasket.org
> Waterskis.org
> RentDVD.org
> PublicAuctions.org
> PlatinumJewelry.org
> Jewelryboxes.org
> ConsumerRatings.org
> SafeShopping.net
> PromiseRing.net
> OnlyShopping.net
> KitchenGifts.net
> GardenLights.net
> DiscountCarparts.net
> BuyFlowers.net
> BasketballGifts.net
> Training-Gear.com
> SprayPerfume.com
> SpinningJewelry.com
> Ski-Jackets.com
> ShoeGuy.com
> Princess-Shoes.com
> PersianRugstore.com
> Perfume-Cologne.com
> PerfumeAuctions.com
> PageantGifts.com
> Newcologne.com
> Lidshop.com
> KitchenLights.com
> JeepGear.com
> JaguarGear.com
> HotHighheels.com
> HiddenGem.com
> HeavenlyJewelry.com
> FashionProfits.com
> FallGear.com
> FabulousImports.com
> DiscountHDTVs.com
> DesignerDinnerware.com
> CollegeMemorabilia.com
> ChocolateTurtles.com
> CertifiedGemstones.com
> Buy-Watches.com
> BirthstoneJewelry.com
> BestHandbag.com
> BestColognes.com
> BestbodyJewelry.com
> BeddingBoutique.com
> BargainLights.com
> AutomotiveNeeds.com
> Artmecca.com
> AffordableBedding.com
> Wilderness.biz
> Whiteners.net
> Whiten.net
> Warranty.net
> Warranties.biz
> Wakeboards.org
> Vivacious.org
> Tweaks.net
> True.biz
> Translates.org
> Translates.net
> Transact.biz
> Trained.net
> Thinner.net
> Technology.biz
> Tattoed.com
> Surnames.biz
> Sunshine.biz
> Successful.biz
> Subcontracts.net
> Storefront.biz
> Stogies.net
> Stimulates.net
> Spoken.net
> Specializes.net
> Sophisticated.biz
> Softener.net
> Socialize.biz
> Snooze.net
> Snapped.net
> Sightings.info
> Setlist.org
> Series.org
> Semiconductors.biz
> Scented.biz
> Rumours.biz
> Rhinestones.net
> Revenues.biz
> Residuals.biz
> Reminders.net
> Relocator.net
> Relo.org
> Relaxing.net
> Rekindle.com
> Rejuvenation.biz
> Rejuvenates.com
> Redirects.net
> Pursue.biz
> Publishes.net
> Prosecutes.com
> Promotes.net
> Prom.biz
> Priceless.org
> Preschools.biz
> Prelaunch.org
> Prelaunch.net
> Preforeclosure.biz
> Prankster.net
> Possibilities.net
> Position.biz
> Porky.net
> Playoffs.biz
> Phonics.biz
> Pasttimes.net
> Overstocks.net
> Nutritious.net
> Namers.net
> Mustache.net
> Multimillionaires.net
> Miniblinds.biz
> Minibikes.biz
> Mingle.biz
> Marinade.biz
> Liquidates.com
> Libations.net
> Leases.org
> Layouts.biz
> Launching.net
> Kwanza.info
> James.biz
> Inspirational.biz
> Innocent.net
> Ideas.biz
> Housesitting.net
> Houseowners.net
> Housekeeping.biz
> Hotwings.biz
> Homeowner.biz
> Homegyms.biz
> Homebuilders.biz
> Halftime.biz
> Halfprice.info
> Haggle.net
> Guides.net
> Groupies.net
> Groundbreaking.net
> Givers.net
> Fruitcakes.biz
> Fruitbaskets.biz
> Frugal.biz
> Formals.biz
> Foreclosure.biz
> Flirting.net
> Flattens.com
> Financials.org
> Financials.biz
> Filtration.biz
> Filet.net
> Feeds.net
> Ezines.net
> Extravagant.biz
> Exposes.net
> Excited.net
> Excels.net
> Enrolled.net
> Endure.biz
> Elevates.com
> Durangos.net
> Downloads.net
> Doghouses.org
> Discovers.net
> Dazed.net
> Customizations.com
> Crayons.net
> Convenience.net
> Consolidation.biz
> Communicator.net
> Communicates.org
> Claddagh.biz
> Cheeseburgers.net
> Charles.biz
> Cashflow.biz
> Carbohydrate.biz
> Cabinetry.biz
> Buddy.biz
> Breathalyzer.biz
> Borrowers.net
> Bookbags.biz
> Bodypiercings.biz
> Bling.info
> Blemishes.org
> Bartender.biz
> Authenticates.com
> Attracts.net
> Attire.biz
> Arrests.net
> Arouses.net
> Appraisals.biz
> Animators.net
> Aggressive.biz
> Accredited.net
> Accept.net
> Abilene.org
> Zoologists.net
> Videotape.biz
> Videoblogging.org
> Turntables.biz
> Tournaments.biz
> Tonneau.biz
> Teleconference.biz
> Telecommuter.biz
> Teddies.biz
> Tahoma.biz
> Seats.biz
> Redesign.biz
> Petbeds.biz
> Pensacola.biz
> Mpegs.biz
> Milehigh.org
> Krista.biz
> Jpegs.biz
> Immunity.biz
> Husbands.biz
> Homejob.biz
> Golfswing.biz
> Filipino.biz
> Females.biz
> Bustiers.net
> Budgets.biz
> Boosters.biz
> Accelerators.biz
> SuperstarSports.com
> Spreads.Net
> proflexsports.com
> PlayoffGames.Com
> NCAApolls.com
> Metfans.com
> InsideBasketball.com
> Hokiefootball.com
> GamedayFootball.com
> FootballRank.Com
> football-fantasy.com
> footballBB.com
> fantasynascar.net
> DiscountGolfclubs.Net
> Cornhuskers.Net
> AmazingSports.com
> SportsTrivia.Info
> SportsApparel.Info
> SoccerEquipment.Info
> FootballPicks.Info
> WomensBasketball.Biz
> Terrapins.Biz
> Sportsline.Biz
> SportsCollectibles.Biz
> SoccerEquipment.Biz
> Seminoles.Biz
> Playoffs.Biz
> PaintballGear.Biz
> Inflatableboats.Biz
> Halftime.Biz
> Gamecocks.Biz
> FootballJerseys.Biz
> Series.Org
> FootballRankings.Org
> CollegeGames.Org
> CollegeFootballNews.Org
> ClemsonFootball.Org
> Warchant.Net
> Teamplay.Net
> SuperbowlPools.Net
> PennStateFootball.Net
> FootballScores.Net
> CollegeFootballNews.Net
> SteelersGear.Com
> NordicEquipment.Com
> NetSportscenter.Com
> JaguarGear.Com
> Hotcorner.Com
> HockeyDiscussion.Com
> FootballSportsline.Com
> FootballShopping.Com
> CollegeMemorabilia.Com
> Bowlbetting.Com
> PrinterDrivers.Net
> InkCartridges.Net
> FreeAnimation.Net
> FlashAnimations.Net
> FaxSoftware.Net
> DesktopIcons.Net
> WindowsIcons.Com
> Storagemarket.com
> RealComputing.Com
> PhotoshopTutorial.Com
> PChelponline.Com
> LaptopCentral.Com
> Digitalvideosoftware.com
> ComputersWorld.Com
> ComputerScanners.Com
> ComputerNotebooks.Com
> CleanYourComputer.Com
> CheapKeyboards.Com
> ITmanagement.info
> HighSpeedInternet.info
> FreeDVDs.info
> DigitalSatellite.info
> WirelessNetworks.biz
> Technicaltraining.biz
> Nanobiotechnology.biz
> InternetTraining.biz
> Inkrefill.biz
> HighspeedInternet.biz
> GraphicsCards.biz
> DvdWriters.biz
> DvdCopy.biz
> DvdCases.biz
> DigitalSatellite.biz
> DesktopComputers.biz
> ComputerMonitors.biz
> ComputerAnimation.biz
> Dvdcopier.org
> WirelessPDA.com
> TattooTechnology.com
> StemcellTechnology.com
> StemcellReplacement.com
> Smartdvds.com
> SEOtechnology.com
> PDAexpert.com
> NewDesktops.com
> Learnexcel.com
> LearnEmail.com
> Fuelcelltech.com
> Free-Webcam.com
> CheapPlasma.com
> Caddsoftware.com
> Bestdvdsoftware.com
> BargainGPS.com
> WeightlossTips.biz
> Virility.biz
> Fastweightloss.biz
> Weightroom.net
> MuscleBuilding.net
> Medication.net
> Healthsavings.net
> BuildMuscle.net
> Backaches.net
> AerobicExercise.net
> AbWorkout.net
> AbExercises.net
> Abdominals.net
> Pharmhealth.com
> OnlineOptical.com
> NetMedicalCenter.com
> Net-Med.com
> Muscleandhealth.com
> MegaVitamins.com
> Lowerhealthrates.com
> LongerLives.com
> Improvelibido.com
> Healthyweightlossdiets.com
> Healthinsureamerica.com
> Healthengines.com
> GetMuscle.com
> Freeonlinediet.com
> Eweightlifting.com
> Discountmedbooks.com
> Dentaldiscountcard.com
> Bodyrenewal.com
> Bodybuildingnews.com
> AbMuscles.com
> Hyperbaric.info
> Ephedra.info
> Wheelchairs.biz
> Viacreme.biz
> ToothWhitening.biz
> StopSnoring.biz
> SkincareProducts.biz
> ProfessionalHaircare.biz
> Pedicures.biz
> Oncologist.biz
> NutritionSupplements.biz
> Newdiet.biz
> Mesotherapy.biz
> Manicures.biz
> Libido.biz
> Hyperbaric.biz
> HomeGyms.biz
> GenericDrugs.biz
> DiscountMedication.biz
> Cryogenics.biz
> CoralCalcium.biz
> Bodysculpting.biz
> AirPurification.biz
> NutritionSupplements.org
> HealthQuote.org
> GeneticMedicine.org
> DaySpa.org
> ContactLens.org
> Workingout.net
> MedicationInformation.net
> EasyWeightLoss.net
> Discountfitness.net
> UKhealthfoods.com
> QualityHealthFoods.com
> Ourhealthplan.com
> Instanthealthquotes.com
> HealthyDiscussion.com
> GroupDiets.com
> FavoritePharmacy.com
> Discount-Nutrition.com
> DependableDental.com
> BargainViagra.com
> AuthenticBeauty.com
> Advancedmedicaltechnology.com
> Advancebodynutrition.com
> Acnecareformula.com
> OnlinePromotion.info
> WebPromotions.info
> WebVentures.biz
> WebsiteTraffic.biz
> Webpromote.biz
> VirtualHosting.biz
> Topsites.biz
> Sitepromotions.biz
> Sitepromotion.biz
> SearchRankings.biz
> SearchPromotion.biz
> OnlinePromotion.biz
> NetProperties.biz
> NetPromotion.biz
> Netdesigns.biz
> Multimediadesigns.biz
> Hotsites.biz
> Hotproperties.biz
> Bargaindomains.biz
> WinampSkins.net
> SitePromote.net
> SellingOnline.net
> InternetConsulting.net
> ICQskins.net
> HtmlTutorial.net
> Groupemail.net
> Freewebpage.net
> EmailNewsletters.net
> DiscussionForums.net
> WebpageDesign.net
> Iclasses.net
> WebstoreBuilders.com
> WebsiteScripts.com
> WebsiteIncome.com
> Websitehostprovider.com
> WebsiteBackups.com
> Webmaster-Forum.com
> Waitinglistservices.com
> TrainingWebsite.com
> TrafficUpgrade.com
> Topdotnames.com
> TextFonts.com
> Stickyserver.com
> SpanishServer.com
> SmartSites.com
> ServerNow.com
> ScreamDesigns.com
> RateHosting.com
> Rankbest.com
> Publishsite.com
> ProtectDomain.com
> Promotionz.com
> PromotionBiz.com
> Primewebspace.com
> PowerPromote.com
> PowerfulMarketing.com
> P2Psites.com
> ObtainDomains.com
> ObtainDomain.com
> NiceDots.com
> NameProperties.com
> NamePreserve.com
> MegaPromotion.com
> MaximumPromotions.com
> LowcostDesigns.com
> LiveRegister.com
> Linkventures.com
> LifetimeHosting.com
> InternetIncorporated.com
> InfoHosting.com
> IncreaseVisitors.com
> Hotresponder.com
> HostingSearch.com
> Hitnetwork.com
> Guerrillapromotions.com
> FindAdvertisers.com
> FetchDomain.com
> FastInternetAccess.com
> EnhancedInternet.com
> EmailPayments.com
> EmailAnnounce.com
> EcommerceTraffic.com
> DrivingHits.com
> DownloadEbook.com
> Dotcomdomain.com
> Domainsyndicate.com
> Domainnameprofits.com
> DiscussionSearch.com
> Discountdotcoms.com
> DiscountDomains.com
> DesktopPrivacy.com
> Deletedomains.com
> CreativeWebmasters.com
> CoolNewsletters.com
> Clubmeg.com
> Broadbandinfo.com
> Banner-Design.com
> AffiliateStorm.com
> Adstoclick.com
> 30Megs.com
> Downloaded.info
> Webhostingservices.biz
> EmailAdvertising.biz
> DedicatedServer.biz
> Datafeeds.biz
> BannerDesign.biz
> AnimatedScreensavers.biz
> AffordableWebhost.biz
> SiteLaunch.net
> Hyperlinking.net
> WebsiteResellers.com
> WebsiteBrokers.com
> Verybesthosting.com
> UKwebtools.com
> TrialDownloads.com
> SeoTechnology.com
> PremierClicks.com
> Modernhosting.com
> Masshost.com
> LowcostDomain.com
> KeywordRevenue.com
> InnovativeDomains.com
> HostingTraffic.com
> Homepagegoodies.com
> FlashResources.com
> DomainBackorders.com
> ClickCorporation.com
> CheapEmail.com
> BestDedicatedServers.com
> AffordableColo.com
> AffordableClicks.com
> Affiliatetrac.com
> Credithistory.info
> Cleancredit.info
> Personalloansonline.biz
> Paydayadvances.biz
> Daytrading.biz
> Cleancredit.biz
> Autofinancing.biz
> Onlineautoloans.net
> Interestcalculator.net
> Homemortgagerate.net
> HomeImprovementLoans.net
> EliminateDebt.net
> DebtManagement.net
> Creditapplications.net
> Consolidates.net
> Consolidateloans.net
> Carlender.net
> Cardsearch.net
> Bestmortgages.net
> VAfinancing.com
> Sophisticatedinvestor.com
> Realestatedollars.com
> Qualityquote.com
> Principalmortgages.com
> Premierlenders.com
> Personalizedquotes.com
> Need-Cash.com
> Mrsmoney.com
> Mortgagepoints.com
> Megafinancial.com
> Marketsigns.com
> LoanCompanies.com
> LendingSearch.com
> Howsmycredit.com
> Hotstocknews.com
> Homeloanswithbadcredit.com
> Hedgeinvestment.com
> Grandeproperties.com
> Freescholarshipmoney.com
> Freehealthquote.com
> Freecreditcheckreport.com
> Forsalelisting.com
> Financialguides.com
> Financialforums.com
> Dentalandhealth.com
> DeliverCash.com
> Debtfreefinancial.com
> Dallas-Mortgages.com
> Creditindependence.com
> Creditfinances.com
> Creditcardsearches.com
> CompleteCredit.com
> Cashfunds.com
> Cashbackmortgage.com
> Cashadvancebiz.com
> Carloancompany.com
> Carfinancingcompany.com
> Budgetquote.com
> Bestrealtors.com
> Alanmortgage.com
> Advertiserealty.com
> WaterfrontProperty.Info
> RealEstateProperties.Info
> MedicalBilling.Info
> DebtElimination.Info
> Warranties.Biz
> UnsecuredCreditCards.Biz
> TaxRefunds.Biz
> StockPicks.Biz
> SavingsAccounts.Biz
> RealEstateMarketing.Biz
> QuickLoans.Biz
> Preforeclosure.Biz
> PersonalFinances.Biz
> NoMoneyDown.Biz
> NeedMoney.Biz
> Mesotherapy.Biz
> LoanCalculators.Biz
> InsuranceRates.Biz
> InsuranceOnline.Biz
> HouseInsurance.Biz
> Homeowner.Biz
> FreeInsuranceQuotes.Biz
> Foreclosure.Biz
> Financials.Biz
> ExchangeMoney.Biz
> EmergencyCash.Biz
> CreditCounseling.Biz
> CreditCardProcessing.Biz
> CreditCardConsolidation.Biz
> Consolidation.Biz
> CheckingAccounts.Biz
> CheckCredit.Biz
> CashFlow.Biz
> AutomobileLoans.Biz
> Appraisals.Biz
> YourMoney.Org
> TaxQuestions.Org
> RefinanceHome.Org
> PlatinumCard.Org
> LoanCalculators.Org
> Leases.Org
> HomeAppraisals.Org
> FreeCreditScores.Org
> FreeCreditRepair.Org
> ForeclosureSearch.Org
> Financials.Org
> FederalGrant.Org
> CreditRating.Org
> CashMoney.Org
> ATMmachines.Org
> StudentHealthInsurance.Net
> SixFigure.Net
> AffordableLending.Net
> ValueQuotes.Com
> TotalCreditRepair.Com
> TaxReturnServices.Com
> TaxDebtHelp.Com
> StockGains.Com
> Stock-Forecast.Com
> RussianMoney.Com
> RealDebtConsolidation.Com
> PremierMortgageCompany.Com
> PremierLender.Com
> NorthstarLoans.Com
> NewJerseyLending.Com
> MBAloans.Com
> MBAFinancing.Com
> Lowest-Quotes.Com
> Legalstuff.Com
> InvestmentGrowth.Com
> HardFunds.Com
> Fhahomeloan.Com
> Fastinsurancequotes.Com
> CompleteLending.Com
> Party.biz
> FirstDate.biz
> Blinddates.biz
> OnlineCam.org
> Romanticpoems.net
> OnlineDates.net
> Hot4U.net
> Freedates.net
> Flings.net
> CanadianSingles.net
> AttractWomen.info
> VirtualWebcam.com
> SpanishDates.com
> RomanticUniverse.com
> RomanticNights.com
> Romanticideas.com
> RomanticDesires.com
> PremierPersonals.com
> PersonalAdz.com
> PCdate.com
> OurChatrooms.com
> Online-Loves.com
> Miami-Singles.com
> MatureMatches.com
> Lovescents.com
> LoversTalk.com
> LoverChat.com
> LoveLiasons.com
> LoveHints.com
> LoveCelebrations.com
> JoeRomance.com
> IntouchDating.com
> IntimateCams.com
> Internetdatingsites.com
> InteractiveRomance.com
> IncredibleDates.com
> IdealLover.com
> HotPartner.com
> Hotcamchat.com
> HispanicLovers.com
> Heavenlyromance.com
> HeavenlyMatches.com
> Heavenlydates.com
> GreaterLove.com
> Friendlydates.com
> Friendlydate.com
> Eurointro.com
> DeeperLove.com
> DatefinderUK.com
> Creativedating.com
> Connectsingles.com
> ChristianRomances.com
> ChristianDatingAgency.com
> Chinese-Women.com
> ChicPersonals.com
> Chatroomtalk.com
> Chatpartner.com
> Chatattack.com
> Chatalittle.com
> BelovedNet.com
> VoiceChat.biz
> Singlesdating.biz
> Romantic.biz
> RealWomen.biz
> PhotoPersonals.biz
> LiveWebcams.biz
> Hardbodies.biz
> Chatting.biz
> Chatcam.biz
> AdultPersonals.biz
> VideoDating.org
> RomanceChat.org
> PhoneChat.org
> LatinDating.org
> Icqchat.net
> SexySingles.info
> RomanticIdeas.info
> MeetPeople.info
> LoveYou.info
> TrueRomantics.com
> SeductivePassion.com
> PremierChat.com
> PlatinumSingles.com
> PlatinumLovers.com
> PassionateLovers.com
> Meetlocalpeople.com
> InternetChats.com
> HotJews.com
> HeavenlySingles.com
> Freelivecamz.com
> EligibleSingles.com
> DistanceDating.com
> BlinddateChat.com
> BeautyPersonals.com
> BeautyDating.com
> AbsoluteMatch.com
> 3Dchatrooms.com
> WholesaleDistributor.biz
> WhiteWedding.biz
> UpstartStartups.com
> Transacts.net
> TexasRestaurants.com
> Startups.info
> Startups.biz
> StartupNetwork.com
> SmarterJobs.com
> Sixfigurebusiness.com
> Safebiz.com
> Resumez.com
> ResumeResource.com
> Restaurantsupply.biz
> RepairBusiness.com
> Relocationservices.biz
> RefundProcessing.com
> Realtimecommerce.com
> RealPlans.com
> QualityPromotions.com
> ProjectManagers.biz
> Profits.biz
> PremierLingerie.com
> Placement.biz
> OvernightDelivery.net
> Ourprofessionals.com
> Onlineprofessional.com
> Onlinecopywriting.com
> Online-Billing.com
> Newresumes.com
> MissBiz.com
> MerchantSolutions.biz
> Merchantnow.com
> MBAloans.com
> MassageBusiness.com
> Legalbusiness.com
> Leadprofits.com
> Killerbiz.com
> Joblistings.biz
> InteractivePromotion.com
> InstantInvoice.com
> IndustrialEngineer.net
> Incorporates.net
> ImportingBusiness.com
> Ideasforbusiness.com
> HospitalityJobs.net
> HomesInspector.com
> HighTechStaffing.com
> Healthcarestaffing.biz
> Goodbiz.net
> Globalmerchant.com
> Gatormoving.com
> FreelanceSearch.com
> FreeBusiness.info
> Floridapromotions.com
> Executivejobs.biz
> Environmentalbiz.com
> Enhanceinternational.com
> Engineeringclasses.com
> Employmentscreenings.com
> EcommerceServices.biz
> Driveprofits.com
> Distinguishedresumes.com
> Dieticians.biz
> Detectives.biz
> Dentisthotline.com
> Delivertoday.com
> Daycarebiz.com
> Compustaffing.com
> Compensated.com
> Civilengineer.net
> Centralbiz.com
> Caribbeanbiz.com
> Cardservices.net
> Cardmerchants.com
> BusinessPromotions.net
> Businessmba.com
> Businessmarketresearch.com
> Businessleads.biz
> Buildingcontractors.biz
> Building-Construction.com
> Brewcompany.com
> Boostbiz.com
> AdvertisingServices.net
> XangoBusiness.com
> Workbooks.biz
> WeddingConsultant.biz
> TranslationSystem.com
> TimeManagement.biz
> TechnicalColleges.info
> StructuresEngineering.com
> Researchers.biz
> RemodelingRepairs.com
> NoniDistributor.com
> MBAclasses.com
> MarketingAbility.com
> LandscapeDesigns.biz
> GovernmentContracts.biz
> GeotechEngineering.com
> GeneralContractors.net
> FocusedAdvertising.com
> EngineeringDegree.org
> Dropships.net
> Construction-Work.com
> ConfidentWomen.com
> BathroomRemodeling.biz
> ZFK.net
> ZBO.com
> YLU.net
> YFR.net
> wwo.biz
> WUH.net
> WTU.biz
> WOI.biz
> WLB.info
> WCY.net
> WCG.info
> VUY.net
> VTJ.net
> VRI.info
> VBK.biz
> vaa.biz
> UTC.biz
> URE.biz
> UNY.net
> UFL.biz
> UDU.info
> UDS.info
> TJL.com
> SWV.biz
> SUO.biz
> STK.info
> SQM.net
> SPO.biz
> SNB.biz
> SHC.info
> SGK.net
> RZP.net
> RXG.info
> RWH.net
> RVC.info
> RTY.net
> RTY.biz
> RPD.biz
> RNB.biz
> RLR.net
> RKN.biz
> rfn.biz
> RCD.info
> PZO.net
> PRT.info
> PNP.info
> PBD.info
> OUX.com
> OUC.info
> OTD.net
> ORS.info
> ONJ.info
> OLB.net
> OFD.biz
> NWR.info
> nno.biz
> nfn.biz
> MTR.biz
> MRF.biz
> MOO.biz
> MIF.biz
> MFP.biz
> MEU.info
> MDZ.biz
> LYO.net
> LTN.org
> LTI.biz
> LRE.info
> LNS.info
> LNK.info
> LLA.biz
> LBY.net
> KOB.info
> KJP.net
> JMD.net
> JIW.net
> JHT.net
> IVY.biz
> IMA.biz
> IKO.info
> IGN.info
> IBL.info
> HRJ.net
> HRA.biz
> HFO.org
> GWN.biz
> GTW.biz
> GKW.net
> GJM.org
> FPT.biz
> FCU.info
> EWZ.net
> EUL.biz
> EPX.net
> EPP.biz
> EPO.biz
> EME.biz
> ECJ.biz
> EBZ.net
> EBJ.net
> DPS.biz
> DMD.biz
> DLW.info
> DFP.info
> DBZ.info
> DBB.biz
> CTE.biz
> CTD.info
> CRO.biz
> CRI.biz
> CKT.info
> CHM.biz
> CCP.org
> CAG.biz
> BUH.info
> BTJ.info
> BST.biz
> BSD.biz
> BPH.net
> BOT.biz
> BNA.biz
> BLA.biz
> BHS.biz
> BDL.biz
> BDJ.net
> BDH.info
> BBH.biz
> AWU.biz
> AWL.biz
> AVU.net
> ASJ.biz
> AMW.info
> AFL.biz
> ADL.biz
> ADF.biz
> ACM.biz
> DJU.info
> HCK.info
> APU.info
> HKR.info
> WTG.info
> ILF.info
> TUH.biz
> MKP.biz
> MDV.biz
> RJI.biz
> GFC.biz
> BYN.org
> MAY.biz
> RON.biz
> PIG.biz
> CFE.biz
> WTK.biz
> OPK.biz
> OKL.biz
> PTM.biz
> FPR.biz
> SNN.biz
> BOH.biz
> -----------------------------------------------
>
> CHECKSUMS:
> -----------------------------------------------
> MD5: 7c465804af52a271de14022cee4163ef
> SHA1: 3609b8325010aa5a8c243b04d9bead834baf68f5
> -----------------------------------------------
>
> POSSIBLE BEHAVIORS:
> -----------------------------------------------
> Possible HTTP Client: Score: 3
> Possible SMTP Client: Score: 4
> -----------------------------------------------
>
> A/V INFO:
> -----------------------------------------------
> SCANNER: VScanner VIRUS: Unknown, file is "suspicious"
> SCANNER: AVG VIRUS: No virus found.
> SCANNER: ClamAV VIRUS: No virus found.
> SCANNER: BDC VIRUS: No virus found.
> -----------------------------------------------
>
> PE INFO:
> -----------------------------------------------
> SECT: .text 269686 0x00000200 <- 0x00001000
> SECT: .rdata 94452 0x00042000 <- 0x00043000
> SECT: .data 26744 0x00059200 <- 0x0005B000
> SECT: .mackt 4096 0x00060000 <- 0x00062000
>
> [kernel32.dll]
> LoadLibraryA
> GetProcAddress
> GetCurrentProcessId
> GetLastError
> FileTimeToSystemTime
> CompareStringW
> CompareStringA
> FlushFileBuffers
> CloseHandle
> CreateFileA
> ReadFile
> WriteConsoleW
> GetConsoleOutputCP
> WriteConsoleA
> SetStdHandle
> RtlUnwind
> RaiseException
> GetCommandLineA
> HeapFree
> GetVersionExA
> HeapAlloc
> GetProcessHeap
> GetStartupInfoA
> TerminateProcess
> GetCurrentProcess
> UnhandledExceptionFilter
> SetUnhandledExceptionFilter
> IsDebuggerPresent
> GetSystemTimeAsFileTime
> GetTimeFormatA
> GetDateFormatA
> GetModuleHandleA
> TlsGetValue
> TlsAlloc
> TlsSetValue
> TlsFree
> InterlockedIncrement
> RestoreLastError
> GetCurrentThreadId
> InterlockedDecrement
> ExitProcess
> WriteFile
> GetStdHandle
> GetModuleFileNameA
> FreeEnvironmentStringsA
> GetEnvironmentStrings
> FreeEnvironmentStringsW
> WideCharToMultiByte
> GetEnvironmentStringsW
> LockResource
> GetFileType
> DeleteCriticalSection
> HeapDestroy
> HeapCreate
> VirtualFree
> QueryPerformanceCounter
> GetTickCount
> LeaveCriticalSection
> EnterCriticalSection
> VirtualAlloc
> HeapReAlloc
> GetCPInfo
> GetACP
> GetOEMCP
> Sleep
> GetTimeZoneInformation
> HeapSize
> InitializeCriticalSection
> MultiByteToWideChar
> GetLocaleInfoA
> SetFilePointer
> GetConsoleCP
> GetConsoleMode
> LCMapStringA
> LCMapStringW
> GetStringTypeA
> GetStringTypeW
> SetEnvironmentVariableA
>
> [user32.dll]
> PostQuitMessage
> DefWindowProcA
> CreateWindowExA
> ShowWindow
> UpdateWindow
> LoadCursorA
> RegisterClassExA
> SetTimer
> GetMessageA
> TranslateMessage
> DispatchMessageA
> KillTimer
> -----------------------------------------------
>
> -------------------------------------------------------------
> jose nazario, ph.d. <jose at arbor.net>
> security researcher, office of the CTO, arbor networks
> v: (734) 821 1427 http://asert.arbornetworks.com/
--
Stephen Gill, Chief Scientist, Team Cymru
http://www.cymru.com | +1 312 924 4023 | gillsr at cymru.com
More information about the nsp-security
mailing list